Check ID:
Provider: Azure
Service:
Severity: LOW
Categories:
Resource type:
appinsights_ensure_is_configuredProvider: Azure
Service:
appinsightsSeverity: LOW
Categories:
loggingResource type:
microsoft.insights/componentsWhat this check verifies
Azure subscription contains at least one Application Insights resource collecting application telemetry (metrics, traces, logs) for monitored workloads. The check determines whether telemetry collection exists at the subscription level, indicating that application monitoring is configured.Risk
If Application Insights is missing, applications run with reduced observability, limiting detection of anomalies and attacks. This undermines integrity and accountability (fewer traces), degrades availability by slowing troubleshooting, and increases exposure to undetected data exfiltration or injection at the app layer.Recommendation
Deploy Application Insights for all critical workloads and centralize data in a Log Analytics workspace. Configure actionable alerts and dashboards, enforce least privilege on telemetry, and set retention/export policies. Use private connectivity and appropriate sampling, and integrate with SIEM for defense in depth.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az monitor app-insights component create —app <APP_NAME> —resource-group <RESOURCE_GROUP> —location <LOCATION> —application-type web —subscription <SUBSCRIPTION_ID>
References
- https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview
- https://www.tenable.com/audits/items/CIS_Microsoft_Azure_Foundations_v2.0.0_L2.audit:8a7a608d180042689ad9d3f16aa359f1
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = appinsights_ensure_is_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks